Node.js fixes 16 flaws exposing servers to crashes and data leaks

On 12 November 2026 The Hacker News reports that Node.js released fixes for 16 vulnerabilities affecting its core HTTP/2, HTTPS and TLS code across the three supported release lines: 22.x, 24.x and 26.x. The company lists fixed versions as 22.23.5, 24.22.3 and 26.13.1.

The flaws include two HTTP/2 issues: a crash in unauthenticated clients that can crash servers using the runtime’s built‑in HTTP/2 support (CVE-2026-123863) and a memory leak flaw that can cause a server to disclose memory contents to a client, including data from other connections (CVE-2026-123866). The report notes that the memory flaw is triggerable across all three lines, with varying conditions depending on the version.

The advisory also covers an HTTPS/TLS memory exposure bug (CVE-2026-123864) that could let an unauthenticated client read memory from other connections, including TLS private keys and other requests, and four additional high‑severity flaws (CVE-2026-123865, CVE-2026-123874, CVE-2026-123875, CVE-2026-126051) plus CVE-2026-123872, all within the Node.js HTTP/2, HTTPS and TLS server code.

Five of the flaws, including CVE-2026-123863 and CVE-2026-123864, were reported by Chris Rohlf with Claude and Anthropic Research, according to the advisory. The piece notes there is no workaround listed for servers unable to update, and that end‑of‑life lines receive no fixes in this release.